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We propose several methods for quantum key distribution 
(QKD) based upon the generation and transmission of ran- 
dom distributions of coherent or squeezed states, and we show 
that they are are secure against individual eavesdropping at- 
tacks. These protocols require that the transmission of the 
optical line between Alice and Bob is larger than 50 %, but 
they do not rely on "non-classical" features such as squeezing. 
Their security is a direct consequence of the no-cloning theo- 
rem, that limits the signal to noise ratio of possible quantum 
measurements on the transmission line. Our approach can 
also be used for evaluating various QKD protocols using light 
with gaussian statistics. 

PACS numbers: 03.67.Dd, 42.50.Dv, 89.70.+C 

Since the experimental demonstration of quantum tele- 
portation of coherent states B , a lot of interest has arisen 
in continuous variable quantum information processing. 
In particular, a stimulating question is whether quan- 
tum continuous variables (QCV) may provide a valid 
alternative to the usual "single photon" quantum key 
distribution schemes Most present proposals to use 
QCV for QKD are based upon the use of "non- 

classical" light beams, such as squeezed light, or pairs of 
light beams that are correlated for two different quadra- 
tures components (the so-called "EPR" beams, by anal- 
ogy with the historical paper by Einstein, Podolski and 
Rosen But recent work on this subject jlTj under- 

lined the crucial importance of the continuous variable 
version of the no-cloning theorem [Q, as soon as secu- 
rity is concerned in any exchange using QCV. 

In this letter, we show that there is actually no need 
for squeezed light : an equivalent level of security may be 
obtained by simply generating and transmitting random 
distributions of coherent states. The security of this novel 
protocols is related to the no-cloning theorem, that lim- 
its possible eavesdropping even though the transmitted 
light has no "non-classical" feature such as squeezing. We 
show that our analysis can be also applied to other pro- 
tocols using light with gaussian statistics, i.e. squeezed 
or EPR beams, making thus the comparison easier. The 
basic tools for this analysis are the ones that have been 
extensively used for linearized quantum optics, includ- 
ing in particular optical quantum non-demolition (QND) 
measurements 119 ]. Before presenting our protocol, we 
will briefly review the current literature on continuous 
variables QKD. 

Here we consider security against individual attacks 
only, and we do not address the issue of uncondition- 
nal security, that was demonstrated by Gottesman and 



Preskill j|] for squeezed states protocols (unconditional 
security of coherent states protocols remains an open 
question). Security against individual attacks was pre- 
viously considered by many authors. Hillery proposed a 
QKD scheme based on binary modulated squeezed light 
0. Cerf et al showed it could be improved considering 
gaussian modulation and described a reconciliation 
protocol HQ to implement this improved protocol. In 
the present work we will generalize this approach to the 
various single beam protocols of the litterature {§-{12) ■ 
The protocol described in [^|j6) is then a particular mem- 
ber of the family of protocols described here. EPR beams 
were also considered for QKD schemes. Some schemes 
need the propagation of one beam only from Alice to Bob 
f)|-|l4||, the other half of the EPR pair being measured 
by Alice, whereas others need the propagation of two 
modes (or more) of the clcctromagnetical field J8|,[l3] [l5| . 
In the first family, Reid jlOj and Ralph || consider "bi- 
nary" modulated EPR beams, created by a parametric 
amplifier with a modulated seed [fto)] or interfering modu- 
lated squeezed beams |l, whereas Silberhorn et al^A 13 
and Navez et al |lj] extract their key from correlated 
measurement sequences. As we will show below, these 
schemes can be viewed as the transmission of a modu- 
lated sub-shotnoise beam. Bencheikh et al jl4| extract 
the binary key directly from the gaussian correlations. 
This extraction can be optimized using the reconciliation 
protocol described in MM. The protocols transmitting 
several quantum-correlated modes of the electromagnetic 
field, using two beams |p|,^3|-^5| are beyond the scope of 
this letter, because their security analysis should take 
into account simultaneous attack on both modes. How- 
ever, similar gaussian extension of these protocols seem 
possible. Finally, Ralph examined a binary modulated 
coherent beam protocol , and showed its need for pri- 
vacy amplification p0| . Here we will introduce a family 
of gaussian protocols, and we will show that the coherent 
state version is secure and as efficient as the correspond- 
ing squeezed light or EPR protocols. 

General principle of the protocols. The QKD protocols 
we study here are single gaussian beam protocols. Alice 
modulate randomly a gaussian beam and send it to Bob 
through a gaussian noisy channel. Both phase and am- 
plitude are modulated with gaussian random numbers, 
since it allows an optimal information rate Bob 
then measures either the phase or the amplitude of this 
beam and informs Alice which measurement he made. 
Bob and Alice have then two correlated sets of gaussian 
variables, from which they can extract a common secret 
string of bits as explained below. 
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The basic tool that we will use is the Shannon formula 
giving the optimum information rate I of a noisy trans- 
mission channel, in units of bits/symbol If the noise 
is white and gaussian and the signal to noise ratio (SNR) 
is E, this optimum information rate is 

7^ B = l/21og 2 (l + S). (1) 

Since this optimum can be closely approached only if the 
signal has a gaussian statistics J21] , we will consider only 
gaussian modulation protocols, and use ([!]) to calculate 
the amount of private information that Alice and Bob 
may exchange in presence of the eavesdropper Eve. 

The sliced reconciliation protocol described in detail in 
HQ and briefly sketched in the Appendix allows us to 
get arbitrarly close to the value given by ([!]). For secu- 
rity purposes, one must assume that Eve has an arbitrary 
powerful computer, and thus she is able to reach this 
limit. In case Alice and Bob are not, they will have to al- 
low for an extra security margin (see Discussion below). 
We note that it is not required to specify a "digitizing 
step" to connect the continuous variable and a bit value: 
the bits will appear at the end of the reconciliation pro- 
tocol At this stage, Alice and Bob share a string 
of bits which is partly known by Eve. They can then use 
standard privacy amplification protocol |25[ to agree on 
a secret key. The rate at which this secret key can be 
constructed is 

AI = I AB -I AE , (2) 

where Iab {Iae) is the information rate between Alice 
and Bob (Eve). 

Eavesdropping. The Iab term of (^) is easy to com- 
pute for a given scheme, the signal to noise ratio 
being known. We have to assume Iae being the maxi- 
mum possible given the laws of physics (considering only 
individual attacks, coherent attacks are beyond the scope 
of this letter) . If the protocols are globally invariant un- 
der the exchange of the two quadratures X and P, the 
best tactic for Eve is to keep this property in her attacks. 
Therefore, we can restrict us to attacks that treat equally 
both quadrature without loss of generality. 

Given these hypothesis, we will use a general result, 
that is demonstrated in [|l7j : if the added noise on Bob's 
side is X-/Vo, where Nq is the vacuum noise variance, then 
the minimum added noise on Eve's side is x -1 -^o- This 
applies to both quadratures, and the added noise may 
be due to line losses, eavesdropping, or any other reason 
. Since the demonstration of ref. Jl?]] is just another 
form of the no-cloning theorem, it also adresses any indi- 
vidual attack by Eve using a cloning machine |L8| . When 
the line has a transmission r\ with no Eve present, one 
has x = (1 — v)/ 7 !- The best attack for Eve is then to take 
a fraction 1 — 77 of the beam at Alice's site, and to send 
the fraction 77 to Bob through her own lossless line (that 
may be a perfect teleporter). Eve is then totally unde- 
tected, and she gets the maximum possible information 
according to the no-cloning theorem. 



Equation (|2j) shows that these protocols are secure as 
long as Bob has a more in formation on Alice's key el- 
ement than Eve, i.e. as long as Iab > Iae- Since the 
Shannon formula (0) is valid for both Bob and Eve, the 
security condition is just a condition on the signal to 
noise ratios, which turns to be a condition on the added 
noises, since the signal and the noise added at Alice's side 
(quantum noise, Alice's technical noises) are the same. 

AI > H B > H E & X < 1 (3) 

Since x = (1 — v)/ 7 ! f° r a l me with transmission 77, the 
condition \ < 1 requires that 77 > 1/2. Therefore, a 
usable key can be obtained in principle as soon as the 
transmission losses are less 3dB. Taking into account the 
standard loss of 0.2dB/km in optical fibers at 1550 nm, 
the typical range would be around 10 km. 

In this security evaluation, the noise added in Alice's 
side cancels out because it disturbs equally Eve and Bob. 
This 'cancelled' noise includes the quantum noise of the 
beam. As a consequence, the security of these protocols 
relies of the quantum aspects of measuring or copying, 
but not on any quantum feature of the beam, like squeez- 
ing or entanglement. Wc can do quantum cryptography 
with coherent beams, as mentionned by Ralph or 
even with highly noisy beams. Quantum features of the 
beams might influence some characteristics of the pro- 
tocol like the secret key rate or the amount of classical 
communication needed to agree on the secret key, but 
not its security. 

Coherent Beam protocol. Let us now explicitly describe 
the coherent beam protocols of this family: 

1. Alice draws two random numbers Xa and pa from 
a gaussian law with variance VaN 

2. She sends to Bob the coherent state \xa + ipa) 

3. Bob randomly chooses to measure either X or P. 
This measurement can be done perfectly. 

4. Using a classical public channel he informs Alice 
about the observable that he measured (like in the BB84 
protocol, half of the key generated by Alice is unused) 

5. Alice and Bob share two correlated gaussian vari- 
ables. Then they may use the "sliced reconciliation" pro- 
tocol |?]|| to transform it into errorless bit strings. Fi- 
nally, they have to use a standard protocol for privacy 
amplification p3[ in order to distill the private key. 

According to eq. (|l|), the channel rate AI for the pri- 
vate key will be: 

A/=±log 2 (l + £ B )-±log 2 (l + £ £ ) (4) 

The total variance of any quadrature of the beam when 
it leaves Alice's realm is VNq = VaNq + Nq. Using the 
expressions 1 + £5 = j~f^, and 1 + £# = j-fjj^, the 
useful secret information rate is : 

If x < lj AI will increase as a function of the signal 
modulation Va- For large modulation (xV 3> 1), the 
asymptotic value of AI is : 
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while the raw channel rate between Alice and Bob is 

I AB = ±log 2 (V/(l + X )). r 

Squeezed state protocol. This protocol can straightfor- 
wardly be generalized to modulated squeezed beam, with 
a squeezing factor s < 1. The protocol becomes : 

1. Alice chooses randomly if the beam is squeezed in 
X or P (for instance we will later assume the beam being 
X-squeezed). Let denote this squeezed state. 

2. Alice draws two random numbers xa and pa from 
two gaussian laws with variances V xa Nq and V pa Nq. The 
two squeezed direction are indistinguishable for Eve iff 



V XA N + sN = V PA N + ±X = VN 



(7) 



3. Alice sends to Bob the displaced squeezed state 
D(x A + ip a ) 

4. Bob randomly chooses to measure either X or P. 

5. Using a public channel, Alice and Bob inform each 
other about the squeezing direction and the measured 
observable. 

6. Like with coherent states Alice and Bob share cor- 
related gaussian variables, from which they can extract 
a private binary key. 

This protocol obviously reduces to the protocol de- 
scribed above if s = 1. Another limit, where V PA = 
or V — 1/s, is the protocol described by Cerf et al in 
|,§. In this case, information is gathered for the key 
only when Bob makes the right guess. 

To compute the private rate AI, we will average be- 
tween the right guesses and the wrong guesses : 
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The three other signal to noise ratios are obtained by 
replacing x or /and s by x or s . Therefore, 
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Since the s-dependent term of these information rates 
are the same, they cancel each other in AI. The secret 
information rate is thus again given by eq. (^) , and does 
not depend on the degree of squeezing. 

Extension to EPR case. The previous description does 
not apply directly on EPR protocols. However, an EPR 
QKD protocol where Alice keeps one of the beams and 
sends the other to Bob is logically equivalent to a ran- 
domly modulated beam with a sub-shot noise quantum 
variance. Let note Xa the quadrature Alice measures 
and X ou t the same quadrature of the beam sent to Bob 
when it leaves Alice's lab. For a standard non-modulated 
EPR scheme flit] we have the following relations : 



(x\) = (x 2 out ) ee V - 

({X A ~X out ) 2 ) =2s 

(XAX out ) = V - 



(s + l/s)/2 



(12) 
(13) 
(14) 



We can separate Bob's beams in two parts, that are re- 
spectively correlated and uncorrelated with Alice's mea- 
surement, by writing X out = gXA+N where (XaN) = 0. 
Bob's beam is then equivalent to a beam with quantum 
noise (N 2 ^ on quadrature X , which is randomly modu- 
lated with the variable qXa- Using eqs (03,04) one gets: 



(15) 
(16) 



g = 1 - a IV = (1 - s 2 )/(l + s 2 ) 
(iV 2 ) = s(2 — s/V) — 2s/(l + s 2 ). 



These equations describe the case where Alice and Bob 
measure the same quadrature. When Alice changes her 
quadrature, while Bob keeps the same measurement, the 
initial wave packet is reduced onto a noisy quadrature, 
and no useful correlation is generated. On the average, 
the information rate is therefore half of the "equivalent" 
modulation scheme. Using (|l2|), we have then: 
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This value of AI is again just the same as the coherent 
state result (||) for given \ and V, so that s is defined 
by (|l2|). Adding excess noise or a modulation on the 
outgoing beam brings no further improvement. 

Discussion. Various comments are in order. First, it 
appears that non classical features like squeezing or EPR 
correlations have no influence on the achievable secret key 
rate for the family of protocols that were described here. 
This result may not apply to all possible protocols, e.g. , 
we did not consider using a continuous quantum memory. 
On the other hand, since the raw information rate are dif- 
ferent for the same secret key rate, squeezed beams can 
be used to save classical communications during the pri- 
vacy amplification procedure. The EPR beams have also 
the advantage of directly providing quantum-generated 
gaussian noise, rather than having it externally generated 
by Alice. More importantly, entanglement, that is not di- 
rectly used in the present protocols, can be useful to beat 
the 3 dB limit by using more than one beam. Though the 
3 dB loss limit of our cryptography protocols makes their 
security demonstration quite intuitive, there exist multi- 
ples ways for Alice and Bob to go beyond this limit. The 
most radical way is to send many EPR beams through 
the noisy channel, then to use entanglement purification 
p2| to build stored entanglement between Alice and Bob, 
and finally to implement a high fidelity teleporter. For 
any finite value of the losses and EPR entanglement, an 
arbitrarily high fidelity can be achieved [E2J. The no- 
cloning theorem ensures the security of these schemes 
as soon as the fidelity of the teleporter is above 2 /3 [^7) , 
which is equivalent to the 3 dB loss limit discussed above. 
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In some sense, a "lossless" line is re-created by using en- 
tanglement purification. There may exist more realistic 
ways to cross the 3 dB barrier. For instance, Alice and 
Bob may "invert" the reconciliation procedure, with Al- 
ice guessing Bob's measurement instead of Bob guessing 
Alice's value 23 1. This inverted procedure may be more 
efficient, but its complete security analysis is beyond the 
scope of this letter. 

On the practical side, one should note that Bob's detec- 
tors are not ideal, but have a non-zero electronic noise Bq, 
that should be much smaller than N , and a maximum 
(saturation) input power <tBq 3> No, where a ^> 1 is the 
detector's dynamics. Taking into account these charac- 
teristics in the simplest coherent state protocol gives an 
optimum value of the signal variance, Va ~ \f^- An- 
other point is that Alice and Bob may not be able to 
achieve the Shannon limit ([!]), due to limited comput- 
ing power (no such limitation is relevant for Eve). As- 
suming that the effective information rate between Alice 
and Bob is reduced by a factor a < 1, the net secret 
rate becomes AI e ff = cxIab — Iae, and remains posi- 
tive if a > Iae/Iab- The quantity AJ e /y is plotted on 
Fig.l for a = 1 (full lines), and for various values of a 
that are arbitrarily associated with various values of the 
SNR (dashed lines). It is clear from that figure that low 
values of a reduce the transmission range in which the 
protocol is secure. We note that according to Hf7|, the 
sliced reconciliation protocol should yield a ~ 1 (see also 
Appendix), but this may be costly in terms of calcula- 
tion time and public channel transmissions. All these 
constraints should eventually be taken into account to 
choose the most appropriate value of Va- 

As a conclusion, it is possible to design a QKD scheme 
with coherent states, secure against any individual at- 
tack, by using optimized reconciliation protocols and 
privacy amplification. Since the protocol does not re- 
quire squeezing, it can be implemented by sending light 
pulses in a low-loss optical fiber, like in a coherent optical 
telecommunication scheme. In that case, all pulses will 
be useful, but half of the random numbers generated by 
Alice will not be used. We demonstrated that the pro- 
tocol is asymptotically secure [[?J for losses smaller than 
3dB (or a teleportation fidelity larger than 2 /3 jl7j ) , and 
the net information rate for the private key with a large 
signal modulation is l/21og 2 (l/x) = 1/2 log 2 (?y/(l — rj)). 



Appendix : Sliced reconciliation protocol 

In the n-slice version of the reconciliation protocol pro- 
posed in ref . H , the real axis representing the amplitude 
of the signal is split in 2™ intervals s\ =] — oo, — ti], S2 — 



S 2 " 



=]t2»-i, +oo [, where t p 



} - h, -t 2 ] 

and t 2 n-i — 0. Alice assigns an amount of n bits to 
an amplitude that lies in the interval s p , by using the 
parity of p for bit 1, of Floor(p/2) for bit 2, ... , and 
of Floor(p/2 n ~ 1 ) for bit n. After receiving the data, 



Bob makes an optimized guess of the first bit value us- 
ing appropriate weighting functions, that are computed 
by optimizing the choice of the {t p } (this optimization 
is made only once, before exchanging the data). After a 
first correction round by exchanging public data between 
Alice and Bob, Bob knows the correct value of the first 
bit. Then he tries to guess the second bit, with a much 
higher probability of success, because he already knows 
the first one. By increasing both the SNR £ and the 
number of slices, the process gets more and more effi- 
cient, keeping the same main idea : after each correction 
round, Bob can guess the next bit with a higher proba- 
bility. For the 5-slice protocol with £ = 15 presented in 
, the probabilities of guessing right for slices 4 and 5 
are respectively 0.976 and 0.999994, and the efficiency is 
more than 90% of the Shannon limit | log 2 (16) = 2. 
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FIG. 1. Private channel information rate AI as a function 
of the channel noise \. The three curves in full lines corre- 
spond to Va = 1,5,50 from the bottom to the top, assum- 
ing that the reconciliation protocol between Alice and Bob 
reaches the Shannon limit. The three curves in dashed lines 
correspond to the effective A7 with the sames values of Va, 
with (arbitrarily chosen) reconciliation efficiencies a that are 
respectively 0.6, 0.8 and 0.95 of the Shannon limit. 
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